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ABSTRACT 

An unwanted message may be identified by inspecting the payload portion of a 
message being communicated, comparing the characteristics of the payload portion with 
stored data indicating characteristics of other messages, and identifying a security condition 
based on a comparison of the message inspected. The characteristics inspected may include 
the payload portion of a message or the whole message when the characteristics are being 
compared against messages being exchanged on more than one local exchanging system. 
Furthermore, the characteristics of messages may be tracked for comparison against the 
characteristics of future messages. A threshold number of those characteristics may 
subsequently implicate a hostile security condition, even if a current comparison of these 
characteristics does not reach the threshold necessary to implicate a hostile security 
condition. 
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